linux-stable.git/drivers/net/wireless, branch v3.2.99

rt2x00usb: mark device removed when get ENOENT usb error

2018-02-13T18:32:15+00:00

commit bfa62a52cad93686bb8d8171ea5288813248a7c6 upstream.

ENOENT usb error mean "specified interface or endpoint does not exist or
is not enabled". Mark device not present when we encounter this error
similar like we do with ENODEV error.

Otherwise we can have infinite loop in rt2x00usb_work_rxdone(), because
we remove and put again RX entries to the queue infinitely.

We can have similar situation when submit urb will fail all the time
with other error, so we need consider to limit number of entries
processed by rxdone work. But for now, since the patch fixes
reproducible soft lockup issue on single processor systems
and taken ENOENT error meaning, let apply this fix.

Patch adds additional ENOENT check not only in rx kick routine, but
also on other places where we check for ENODEV error.

Reported-by: Richard Genoud 
Debugged-by: Richard Genoud 
Signed-off-by: Stanislaw Gruszka 
Tested-by: Richard Genoud 
Signed-off-by: Kalle Valo 
[bwh: Backported to 3.2: adjust filename, context]
Signed-off-by: Ben Hutchings

ray_cs: Fix array bounds warnings.

2017-11-11T13:34:49+00:00

commit b4c0e72e80e2e04b462ea05cc5a001807d7feed6 upstream.

rx_msg is defined to have a 1 entry array at the end, so gcc warns:

drivers/net/wireless/ray_cs.c: In function ‘rx_authenticate’:
drivers/net/wireless/ray_cs.c:2436:3: warning: array subscript is above array bounds [-Warray-bounds]
drivers/net/wireless/ray_cs.c:2436:3: warning: array subscript is above array bounds [-Warray-bounds]
drivers/net/wireless/ray_cs.c:2436:3: warning: array subscript is above array bounds [-Warray-bounds]
drivers/net/wireless/ray_cs.c:2436:3: warning: array subscript is above array bounds [-Warray-bounds]
drivers/net/wireless/ray_cs.c:2436:3: warning: array subscript is above array bounds [-Warray-bounds]
drivers/net/wireless/ray_cs.c:2439:15: warning: array subscript is above array bounds [-Warray-bounds]
drivers/net/wireless/ray_cs.c:2452:16: warning: array subscript is above array bounds [-Warray-bounds]
drivers/net/wireless/ray_cs.c:2453:18: warning: array subscript is above array bounds [-Warray-bounds]
drivers/net/wireless/ray_cs.c:2453:32: warning: array subscript is above array bounds [-Warray-bounds]

Use a zero length array and rename to "ray_rx_msg" to make sure we hit all
of the necessary cases.

Signed-off-by: David S. Miller 
Signed-off-by: Ben Hutchings

wl1251: add a missing spin_lock_init()

2017-11-11T13:34:37+00:00

commit f581a0dd744fe32b0a8805e279c59ec1ac676d60 upstream.

wl1251: add a missing spin_lock_init()

This fixes the following kernel warning:

 [ 5668.771453] BUG: spinlock bad magic on CPU#0, kworker/u2:3/9745
 [ 5668.771850]  lock: 0xce63ef20, .magic: 00000000, .owner: /-1,
 .owner_cpu: 0
 [ 5668.772277] CPU: 0 PID: 9745 Comm: kworker/u2:3 Tainted: G        W
 4.12.0-03002-gec979a4-dirty #40
 [ 5668.772796] Hardware name: Nokia RX-51 board
 [ 5668.773071] Workqueue: phy1 wl1251_irq_work
 [ 5668.773345] [] (unwind_backtrace) from []
 (show_stack+0x10/0x14)
 [ 5668.773803] [] (show_stack) from []
 (do_raw_spin_lock+0x6c/0xa0)
 [ 5668.774230] [] (do_raw_spin_lock) from []
 (_raw_spin_lock_irqsave+0x10/0x18)
 [ 5668.774658] [] (_raw_spin_lock_irqsave) from []
 (wl1251_op_tx+0x38/0x5c)
 [ 5668.775115] [] (wl1251_op_tx) from []
 (ieee80211_tx_frags+0x188/0x1c0)
 [ 5668.775543] [] (ieee80211_tx_frags) from []
 (__ieee80211_tx+0x6c/0x130)
 [ 5668.775970] [] (__ieee80211_tx) from []
 (ieee80211_tx+0xdc/0x104)
 [ 5668.776367] [] (ieee80211_tx) from []
 (__ieee80211_subif_start_xmit+0x454/0x8c8)
 [ 5668.776824] [] (__ieee80211_subif_start_xmit) from
 [] (ieee80211_subif_start_xmit+0x30/0x2fc)
 [ 5668.777343] [] (ieee80211_subif_start_xmit) from
 [] (dev_hard_start_xmit+0x80/0x118)
...

    by adding the missing spin_lock_init().

Reported-by: Pavel Machek 
Cc: Kalle Valo 
Signed-off-by: Cong Wang 
Acked-by: Pavel Machek 
Signed-off-by: Kalle Valo 
Signed-off-by: Pavel Machek 
Signed-off-by: David S. Miller 
[bwh: Backported to 3.2: adjust filename]
Signed-off-by: Ben Hutchings

wlcore: fix 64K page support

2017-10-12T14:27:09+00:00

commit 4a4274bf2dbbd1c7a45be0c89a1687c9d2eef4a0 upstream.

In the stable linux-3.16 branch, I ran into a warning in the
wlcore driver:

drivers/net/wireless/ti/wlcore/spi.c: In function 'wl12xx_spi_raw_write':
drivers/net/wireless/ti/wlcore/spi.c:315:1: error: the frame size of 12848 bytes is larger than 2048 bytes [-Werror=frame-larger-than=]

Newer kernels no longer show the warning, but the bug is still there,
as the allocation is based on the CPU page size rather than the
actual capabilities of the hardware.

This replaces the PAGE_SIZE macro with the SZ_4K macro, i.e. 4096 bytes
per buffer.

Signed-off-by: Arnd Bergmann 
Signed-off-by: Kalle Valo 
[bwh: Backported to 3.2:
 - Open-code SZ_4K as it is only defined on some architectures here(!)
 - Adjust filename, context]
Signed-off-by: Ben Hutchings

mwifiex: fixup error cases in mwifiex_add_virtual_intf()

2017-10-12T14:27:08+00:00

commit 8535107aa4ef92520cbb9a4739563b389c5f8e2c upstream.

If we fail to add an interface in mwifiex_add_virtual_intf(), we might
hit a BUG_ON() in the networking code, because we didn't tear things
down properly. Among the problems:

 (a) when failing to allocate workqueues, we fail to unregister the
     netdev before calling free_netdev()
 (b) even if we do try to unregister the netdev, we're still holding the
     rtnl lock, so the device never properly unregistered; we'll be at
     state NETREG_UNREGISTERING, and then hit free_netdev()'s:
	BUG_ON(dev->reg_state != NETREG_UNREGISTERED);
 (c) we're allocating some dependent resources (e.g., DFS workqueues)
     after we've registered the interface; this may or may not cause
     problems, but it's good practice to allocate these before registering
 (d) we're not even trying to unwind anything when mwifiex_send_cmd() or
     mwifiex_sta_init_cmd() fail

To fix these issues, let's:

 * add a stacked set of error handling labels, to keep error handling
   consistent and properly ordered (resolving (a) and (d))
 * move the workqueue allocations before the registration (to resolve
   (c); also resolves (b) by avoiding error cases where we have to
   unregister)

[Incidentally, it's pretty easy to interrupt the alloc_workqueue() in,
e.g., the following:

  iw phy phy0 interface add mlan0 type station

by sending it SIGTERM.]

This bugfix covers commits like commit 7d652034d1a0 ("mwifiex: channel
switch support for mwifiex"), but parts of this bug exist all the way
back to the introduction of dynamic interface handling in commit
93a1df48d224 ("mwifiex: add cfg80211 handlers add/del_virtual_intf").

Signed-off-by: Brian Norris 
Signed-off-by: Kalle Valo 
[bwh: Backported to 3.2:
 - There is no workqueue allocation or cleanup needed here
 - Add 'ret' variable
 - Keep logging errors with wiphy_err()
 - Adjust filename]
Signed-off-by: Ben Hutchings

ath9k_htc: fix NULL-deref at probe

2017-08-26T01:13:58+00:00

commit ebeb36670ecac36c179b5fb5d5c88ff03ba191ec upstream.

Make sure to check the number of endpoints to avoid dereferencing a
NULL-pointer or accessing memory beyond the endpoint array should a
malicious device lack the expected endpoints.

Fixes: 36bcce430657 ("ath9k_htc: Handle storage devices")
Signed-off-by: Johan Hovold 
Signed-off-by: Kalle Valo 
Signed-off-by: Ben Hutchings

zd1211rw: fix NULL-deref at probe

2017-08-26T01:13:57+00:00

commit ca260ece6a57dc7d751e0685f51fa2c55d851873 upstream.

Make sure to check the number of endpoints to avoid dereferencing a
NULL-pointer or accessing memory beyond the endpoint array should a
malicious device lack the expected endpoints.

Fixes: a1030e92c150 ("[PATCH] zd1211rw: Convert installer CDROM device into WLAN device")
Cc: Daniel Drake 
Signed-off-by: Johan Hovold 
Signed-off-by: Kalle Valo 
[bwh: Backported to 3.2: adjust filename]
Signed-off-by: Ben Hutchings

ath9k_htc: Add support of AirTies 1eda:2315 AR9271 device

2017-08-26T01:13:57+00:00

commit 16ff1fb0e32f76a5d285a6f23b82d21aa52813c6 upstream.

T:  Bus=01 Lev=02 Prnt=02 Port=02 Cnt=01 Dev#=  7 Spd=480 MxCh= 0
D:  Ver= 2.00 Cls=ff(vend.) Sub=ff Prot=ff MxPS=64 #Cfgs=  1
P:  Vendor=1eda ProdID=2315 Rev=01.08
S:  Manufacturer=ATHEROS
S:  Product=USB2.0 WLAN
S:  SerialNumber=12345
C:  #Ifs= 1 Cfg#= 1 Atr=80 MxPwr=500mA
I:  If#= 0 Alt= 0 #EPs= 6 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none)

Signed-off-by: Dmitry Tunin 
Signed-off-by: Kalle Valo 
Signed-off-by: Ben Hutchings

ath9k_htc: add device ID for Toshiba WLM-20U2/GN-1080

2017-08-26T01:13:57+00:00

commit aea57edf80c6e96d6dc24757599396af99c02b19 upstream.

This device is available under different marketing names:
WLM-20U2 - Wireless USB Dongle for Toshiba TVs
GN-1080 - Wireless LAN Module for Toshiba MFPs.

Signed-off-by: Alexander Tsoy 
Signed-off-by: Kalle Valo 
Signed-off-by: Ben Hutchings

ath9k_htc: Add new USB ID

2017-08-26T01:13:56+00:00

commit 0088d27b78f2c0118aee82923269518616481ea0 upstream.

This device is a dongle made by Philips to enhance their TVs with wireless capabilities,
but works flawlessly on any upstream kernel, provided that the ath9k_htc module is attached to it.
It's correctly recognized by lsusb as "0471:209e Philips (or NXP) PTA01 Wireless Adapter" and the
patch has been tested on real hardware.

Signed-off-by: Leon Nardella 
Signed-off-by: Kalle Valo 
Signed-off-by: Ben Hutchings